Ceragon Networks / Siklu Communication Vulnerabilities and Affected Products

Siklu EtherHaul Series EH-8010 - Arbitrary File Upload

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.